Overview
overview
6Static
static
6Incredible...OT.bat
windows7-x64
1Incredible...OT.bat
windows10-2004-x64
1Incredible...pi.dll
windows7-x64
3Incredible...pi.dll
windows10-2004-x64
3Incredible...pi.dll
windows7-x64
1Incredible...pi.dll
windows10-2004-x64
3Incredible...ck.exe
windows7-x64
1Incredible...ck.exe
windows10-2004-x64
1Incredible...er.apk
Incredible...er.apk
android-10-x64
Incredible...er.apk
android-11-x64
Incredible...db.exe
windows7-x64
1Incredible...db.exe
windows10-2004-x64
1Incredible...usybox
debian-9-armhf
Incredible...s/rage
debian-9-armhf
Incredible...hecage
debian-9-armhf
1Incredible...s/root
ubuntu-18.04-amd64
Incredible...s/root
debian-9-armhf
Incredible...s/root
debian-9-mips
Incredible...s/root
debian-9-mipsel
Incredible...ols/su
debian-9-armhf
Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22-12-2023 14:16
Static task
static1
Behavioral task
behavioral1
Sample
Incredible S一键ROOT/Incredible S一键ROOT.bat
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
Incredible S一键ROOT/Incredible S一键ROOT.bat
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
Incredible S一键ROOT/tools/AdbWinApi.dll
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Incredible S一键ROOT/tools/AdbWinApi.dll
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
Incredible S一键ROOT/tools/AdbWinUsbApi.dll
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Incredible S一键ROOT/tools/AdbWinUsbApi.dll
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
Incredible S一键ROOT/tools/SuperOneClick.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
Incredible S一键ROOT/tools/SuperOneClick.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
Incredible S一键ROOT/tools/Superuser.apk
Behavioral task
behavioral10
Sample
Incredible S一键ROOT/tools/Superuser.apk
Resource
android-x64-20231215-en
Behavioral task
behavioral11
Sample
Incredible S一键ROOT/tools/Superuser.apk
Resource
android-x64-arm64-20231215-en
Behavioral task
behavioral12
Sample
Incredible S一键ROOT/tools/adb.exe
Resource
win7-20231215-en
Behavioral task
behavioral13
Sample
Incredible S一键ROOT/tools/adb.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral14
Sample
Incredible S一键ROOT/tools/busybox
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral15
Sample
Incredible S一键ROOT/tools/rage
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral16
Sample
Incredible S一键ROOT/tools/rageagainstthecage
Resource
debian9-armhf-20231215-en
Behavioral task
behavioral17
Sample
Incredible S一键ROOT/tools/root
Resource
ubuntu1804-amd64-20231215-en
Behavioral task
behavioral18
Sample
Incredible S一键ROOT/tools/root
Resource
debian9-armhf-20231222-en
Behavioral task
behavioral19
Sample
Incredible S一键ROOT/tools/root
Resource
debian9-mipsbe-20231215-en
Behavioral task
behavioral20
Sample
Incredible S一键ROOT/tools/root
Resource
debian9-mipsel-20231222-en
Behavioral task
behavioral21
Sample
Incredible S一键ROOT/tools/su
Resource
debian9-armhf-20231215-en
General
-
Target
Incredible S一键ROOT/tools/AdbWinApi.dll
-
Size
94KB
-
MD5
47a6ee3f186b2c2f5057028906bac0c6
-
SHA1
fde9c22a2cfcd5e566cec2e987d942b78a4eeae8
-
SHA256
14a51482aa003db79a400f4b15c158397fe6d57ee6606b3d633fa431a7bfdf4b
-
SHA512
6a2675de0c445c75f7d5664ebe8f0e2f69c3312c50156161e483927e40235140d5e28e340112ac552d6462366143890a8ce32dbf65bd37e27cb1ea290fe14584
-
SSDEEP
1536:npCxybY0FS6MqS6WvgD9xj03TabrFvY5J6sCGt:npo0k6ZWVTaif6sCG
Malware Config
Signatures
-
Program crash 1 IoCs
pid pid_target Process procid_target 2532 2552 WerFault.exe 28 -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2988 wrote to memory of 2552 2988 rundll32.exe 28 PID 2988 wrote to memory of 2552 2988 rundll32.exe 28 PID 2988 wrote to memory of 2552 2988 rundll32.exe 28 PID 2988 wrote to memory of 2552 2988 rundll32.exe 28 PID 2988 wrote to memory of 2552 2988 rundll32.exe 28 PID 2988 wrote to memory of 2552 2988 rundll32.exe 28 PID 2988 wrote to memory of 2552 2988 rundll32.exe 28 PID 2552 wrote to memory of 2532 2552 rundll32.exe 29 PID 2552 wrote to memory of 2532 2552 rundll32.exe 29 PID 2552 wrote to memory of 2532 2552 rundll32.exe 29 PID 2552 wrote to memory of 2532 2552 rundll32.exe 29
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Incredible S一键ROOT\tools\AdbWinApi.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:2988 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\Incredible S一键ROOT\tools\AdbWinApi.dll",#12⤵
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2552 -s 2443⤵
- Program crash
PID:2532
-
-